From nobody Tue Oct 7 23:15:02 2025 Received: from szxga04-in.huawei.com (szxga04-in.huawei.com [45.249.212.190]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41B6427A101; Fri, 4 Jul 2025 07:40:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.190 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1751614836; cv=none; b=K0hht0MdYR8AB1SLo+BlLOxeLpx+0N1kotPX/3/BSW6QVLelm0F1sYZuJHeQey51zYJUTF0bgwf+mF9z+Do6aOvabhrcU6zbiqM9SUo0EYJTJRfTkPACYjXjpP/oQxgDntdX5VeMgtV38BxgkyIGftvYPnuNBOyMPJNa2tZ0JRM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1751614836; c=relaxed/simple; bh=DmKkm+5VZ+nxcvM9V0qn1OfuccxIXOhlkvGYD9U59sw=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=DUMyYa2a9hyZk9OqH0bbWpxXd3WGzwKCiv108nIEjpG5uAoSHAOx3I38i5EEe6N6XGVmMxB9Ky6GokaVrNpbk8tnyQo9Lrcz8dPX7DDoEo3dWDm/xTWz0v5N/pSUMKJW7DoP4rMjQuGAAIz1AXucAk/FaicRNORovHD0046uj5s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.190 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.234]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4bYQVS6KSxz2SSrM; Fri, 4 Jul 2025 15:38:40 +0800 (CST) Received: from kwepemg100016.china.huawei.com (unknown [7.202.181.57]) by mail.maildlp.com (Postfix) with ESMTPS id A11E71402CB; Fri, 4 Jul 2025 15:40:29 +0800 (CST) Received: from huawei.com (10.67.174.33) by kwepemg100016.china.huawei.com (7.202.181.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Fri, 4 Jul 2025 15:40:28 +0800 From: GONG Ruiqi To: Mimi Zohar , Roberto Sassu , Dmitry Kasatkin , Jarkko Sakkinen , Ard Biesheuvel CC: Eric Snowberg , Paul Moore , James Morris , "Serge E . Hallyn" , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , , "H . Peter Anvin" , , , , , , Lu Jialin , Subject: [PATCH v4 1/2] x86/efi: Rename IMA-related function and macro of boot mode Date: Fri, 4 Jul 2025 15:51:13 +0800 Message-ID: <20250704075114.3709609-2-gongruiqi1@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20250704075114.3709609-1-gongruiqi1@huawei.com> References: <20250704075114.3709609-1-gongruiqi1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To kwepemg100016.china.huawei.com (7.202.181.57) Content-Type: text/plain; charset="utf-8" Rename {__x86,arch}_ima_efi_boot_mode to .._integrity_efi_boot_mode, as a preparing step for the next patch to decouple the functionality of arch_ima_get_secureboot() from IMA. No functional change intended. Signed-off-by: GONG Ruiqi --- arch/x86/include/asm/efi.h | 4 ++-- arch/x86/platform/efi/efi.c | 2 +- security/integrity/ima/ima_efi.c | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index f227a70ac91f..fcac86a1327b 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -401,9 +401,9 @@ extern int __init efi_memmap_split_count(efi_memory_des= c_t *md, extern void __init efi_memmap_insert(struct efi_memory_map *old_memmap, void *buf, struct efi_mem_range *mem); =20 -extern enum efi_secureboot_mode __x86_ima_efi_boot_mode(void); +extern enum efi_secureboot_mode __x86_integrity_efi_boot_mode(void); =20 -#define arch_ima_efi_boot_mode __x86_ima_efi_boot_mode() +#define arch_integrity_efi_boot_mode __x86_integrity_efi_boot_mode() =20 #ifdef CONFIG_EFI_RUNTIME_MAP int efi_get_runtime_map_size(void); diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index 463b784499a8..94704858f17a 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -921,7 +921,7 @@ umode_t efi_attr_is_visible(struct kobject *kobj, struc= t attribute *attr, int n) return attr->mode; } =20 -enum efi_secureboot_mode __x86_ima_efi_boot_mode(void) +enum efi_secureboot_mode __x86_integrity_efi_boot_mode(void) { return boot_params.secure_boot; } diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_= efi.c index 138029bfcce1..9f9c30dcde17 100644 --- a/security/integrity/ima/ima_efi.c +++ b/security/integrity/ima/ima_efi.c @@ -7,8 +7,8 @@ #include #include =20 -#ifndef arch_ima_efi_boot_mode -#define arch_ima_efi_boot_mode efi_secureboot_mode_unset +#ifndef arch_integrity_efi_boot_mode +#define arch_integrity_efi_boot_mode efi_secureboot_mode_unset #endif =20 static enum efi_secureboot_mode get_sb_mode(void) @@ -36,7 +36,7 @@ bool arch_ima_get_secureboot(void) static bool initialized; =20 if (!initialized && efi_enabled(EFI_BOOT)) { - sb_mode =3D arch_ima_efi_boot_mode; + sb_mode =3D arch_integrity_efi_boot_mode; =20 if (sb_mode =3D=3D efi_secureboot_mode_unset) sb_mode =3D get_sb_mode(); --=20 2.25.1 From nobody Tue Oct 7 23:15:02 2025 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3854A27A10A; Fri, 4 Jul 2025 07:40:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.255 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1751614835; cv=none; b=F/JyV8NaFJdzvErCDfhnTZ9iY1V2dsOfqKRVk649Cw+zJhZqmmYF4YansE6kPlaO3q8cxEShvP0TepoD6zsK+zJmyGCyrfmZJFsU4FnCrLekhsS3TbRmD86td4GjToARqOaGC9rpCLoiuAnEH5fGG3wq+PYoV6yXLTQXySGXYy4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1751614835; c=relaxed/simple; bh=3Gq7q6sk1e4OCAoXoS9edGKymQuwCCfAdN07peh6VIg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ZAIZI6cORfT9m9nXShL9OmmpBAcfUzkrVoMmpYoy2SjTGyo8u+RBvQYPot+mZIpzLjTEsyHAj78tiPJAzmI9OLhADa2O599G4ojkMJBuWB362Rw/aeNRy/AReV98MIqoWuhWBXaHCs7hLgElMNlArLUafRE2XhrSLHHVMwS9QZo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.255 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.194]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4bYQTf1r75z1d1t7; Fri, 4 Jul 2025 15:37:58 +0800 (CST) Received: from kwepemg100016.china.huawei.com (unknown [7.202.181.57]) by mail.maildlp.com (Postfix) with ESMTPS id 538D6140156; Fri, 4 Jul 2025 15:40:30 +0800 (CST) Received: from huawei.com (10.67.174.33) by kwepemg100016.china.huawei.com (7.202.181.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Fri, 4 Jul 2025 15:40:29 +0800 From: GONG Ruiqi To: Mimi Zohar , Roberto Sassu , Dmitry Kasatkin , Jarkko Sakkinen , Ard Biesheuvel CC: Eric Snowberg , Paul Moore , James Morris , "Serge E . Hallyn" , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , , "H . Peter Anvin" , , , , , , Lu Jialin , Subject: [PATCH v4 2/2] integrity: Extract secure boot enquiry function out of IMA Date: Fri, 4 Jul 2025 15:51:14 +0800 Message-ID: <20250704075114.3709609-3-gongruiqi1@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20250704075114.3709609-1-gongruiqi1@huawei.com> References: <20250704075114.3709609-1-gongruiqi1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To kwepemg100016.china.huawei.com (7.202.181.57) Content-Type: text/plain; charset="utf-8" Commit 92ad19559ea9 ("integrity: Do not load MOK and MOKx when secure boot be disabled") utilizes arch_ima_get_secureboot() to perform a secure boot status check before loading the Machine Owner Key (MOK). However, only when CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=3Dy can this function be functional, while this config could be turned on/off parallelly with CONFIG_LOAD_UEFI_KEYS. So the kernel could behave unintuitively in case that CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=3Dn and CONFIG_LOAD_UEFI_KEYS=3Dy, as it would refuse to load MOK even if secure boot is enabled. Given that what arch_ima_get_secureboot() does is just to retrieve secure boot status via EFI interfaces and can be decoupled with IMA, refactor this functionality into integrity_get_efi_secureboot(), a general helper in the integrity subsystem that both MOK loading and IMA can make use of. By using the new helper, the implicit dependence of CONFIG_LOAD_UEFI_KEYS on CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is removed. Signed-off-by: GONG Ruiqi --- include/linux/integrity.h | 1 + security/integrity/Makefile | 1 + security/integrity/efi_secureboot.c | 46 +++++++++++++++++++ security/integrity/ima/ima_efi.c | 42 +---------------- security/integrity/platform_certs/load_uefi.c | 3 +- 5 files changed, 51 insertions(+), 42 deletions(-) create mode 100644 security/integrity/efi_secureboot.c diff --git a/include/linux/integrity.h b/include/linux/integrity.h index f5842372359b..157d29cab5cd 100644 --- a/include/linux/integrity.h +++ b/include/linux/integrity.h @@ -61,5 +61,6 @@ integrity_inode_attrs_changed(const struct integrity_inod= e_attributes *attrs, !inode_eq_iversion(inode, attrs->version)); } =20 +extern bool integrity_get_efi_secureboot(void); =20 #endif /* _LINUX_INTEGRITY_H */ diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 92b63039c654..45dfdedbdad4 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -18,6 +18,7 @@ integrity-$(CONFIG_LOAD_IPL_KEYS) +=3D platform_certs/loa= d_ipl_s390.o integrity-$(CONFIG_LOAD_PPC_KEYS) +=3D platform_certs/efi_parser.o \ platform_certs/load_powerpc.o \ platform_certs/keyring_handler.o +integrity-$(CONFIG_EFI) +=3D efi_secureboot.o # The relative order of the 'ima' and 'evm' LSMs depends on the order belo= w. obj-$(CONFIG_IMA) +=3D ima/ obj-$(CONFIG_EVM) +=3D evm/ diff --git a/security/integrity/efi_secureboot.c b/security/integrity/efi_s= ecureboot.c new file mode 100644 index 000000000000..64207ae37e6b --- /dev/null +++ b/security/integrity/efi_secureboot.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2025 Huawei Technologies Co., Ltd + */ +#include +#include +#include + +#ifndef arch_integrity_efi_boot_mode +#define arch_integrity_efi_boot_mode efi_secureboot_mode_unset +#endif + +static enum efi_secureboot_mode get_sb_mode(void) +{ + enum efi_secureboot_mode mode; + + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { + pr_info("integrity: secureboot mode unknown, no efi\n"); + return efi_secureboot_mode_unknown; + } + + mode =3D efi_get_secureboot_mode(efi.get_variable); + if (mode =3D=3D efi_secureboot_mode_disabled) + pr_info("integrity: secureboot mode disabled\n"); + else if (mode =3D=3D efi_secureboot_mode_unknown) + pr_info("integrity: secureboot mode unknown\n"); + else + pr_info("integrity: secureboot mode enabled\n"); + return mode; +} + +bool integrity_get_efi_secureboot(void) +{ + static enum efi_secureboot_mode sb_mode; + static bool initialized; + + if (!initialized && efi_enabled(EFI_BOOT)) { + sb_mode =3D arch_integrity_efi_boot_mode; + + if (sb_mode =3D=3D efi_secureboot_mode_unset) + sb_mode =3D get_sb_mode(); + initialized =3D true; + } + + return sb_mode =3D=3D efi_secureboot_mode_enabled; +} diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_= efi.c index 9f9c30dcde17..3cf08f8ca3b7 100644 --- a/security/integrity/ima/ima_efi.c +++ b/security/integrity/ima/ima_efi.c @@ -2,51 +2,13 @@ /* * Copyright (C) 2018 IBM Corporation */ -#include #include #include -#include - -#ifndef arch_integrity_efi_boot_mode -#define arch_integrity_efi_boot_mode efi_secureboot_mode_unset -#endif - -static enum efi_secureboot_mode get_sb_mode(void) -{ - enum efi_secureboot_mode mode; - - if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { - pr_info("ima: secureboot mode unknown, no efi\n"); - return efi_secureboot_mode_unknown; - } - - mode =3D efi_get_secureboot_mode(efi.get_variable); - if (mode =3D=3D efi_secureboot_mode_disabled) - pr_info("ima: secureboot mode disabled\n"); - else if (mode =3D=3D efi_secureboot_mode_unknown) - pr_info("ima: secureboot mode unknown\n"); - else - pr_info("ima: secureboot mode enabled\n"); - return mode; -} +#include =20 bool arch_ima_get_secureboot(void) { - static enum efi_secureboot_mode sb_mode; - static bool initialized; - - if (!initialized && efi_enabled(EFI_BOOT)) { - sb_mode =3D arch_integrity_efi_boot_mode; - - if (sb_mode =3D=3D efi_secureboot_mode_unset) - sb_mode =3D get_sb_mode(); - initialized =3D true; - } - - if (sb_mode =3D=3D efi_secureboot_mode_enabled) - return true; - else - return false; + return integrity_get_efi_secureboot(); } =20 /* secureboot arch rules */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integ= rity/platform_certs/load_uefi.c index d1fdd113450a..deebdbf4393e 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -7,7 +7,6 @@ #include #include #include -#include #include #include #include "../integrity.h" @@ -212,7 +211,7 @@ static int __init load_uefi_certs(void) } =20 /* the MOK/MOKx can not be trusted when secure boot is disabled */ - if (!arch_ima_get_secureboot()) + if (!integrity_get_efi_secureboot()) return 0; =20 mokx =3D get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status); --=20 2.25.1